fix: GH Actions workflows - enforce lint/typecheck, add timeout, fix triggers

- lint.yml: remove || echo so lint errors actually fail the workflow
- typecheck.yml: remove || echo, switch to Bun, add apps/elysia typecheck
- update-submodule.yml: upgrade checkout@v6, add payload validation + push retry
- security.yml: add Rust to CodeQL scan targets
- docker-build-push.yml: remove stale packages/ path refs
- All workflows: add timeout-minutes to prevent stuck jobs

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/deploy-docker.yml

@@ -28,6 +28,7 @@ permissions:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: github.event_name == 'workflow_dispatch' || github.event_name == 'push' || github.event.workflow_run.conclusion == 'success'
     steps:
       - name: Checkout repository